Market adoption of wireless LAN (WLAN) technology has exploded, as users from a wide range of backgrounds and vertical industries have brought this technology into their homes, offices, and increasingly into the public air space. This inflection point has highlighted not only the limitations of earlier-generation systems, but also the changing role WLAN technology now plays in people's work and lifestyles, across the globe. Indeed, WLANs are rapidly changing from convenience networks to business-critical networks. Increasingly users are depending on WLANs to improve the timeliness and productivity of their communications and applications, and in doing so, require greater visibility, security, management, and performance from their network.
In IEEE 802.11 networks, a service set identifier (SSID) identifies a wireless network to which one or more mobile stations may associate. A mobile station can typically learn the SSID from beacon frames transmitted by wireless access points. Alternatively, a mobile station may be configured with an SSID and broadcast probe requests to find a wireless access point that supports the wireless network corresponding to the SSID. In response to a probe request identifying a given SSID, a wireless access point may transmit a directed probe response frame that includes a basic service set identifier (BSSID), which is a link layer or MAC address of the wireless access point.
Early generation wireless access points typically supported one SSID that mapped to one BSSID. As enterprises began to embrace WLAN technologies, wireless access point began to support multiple SSIDs to allow network administrators to group mobile stations into separate WLANs. In early implementations, the multiple SSIDs mapped to the same BSSID. Since, according to the IEEE 802.11 specification, a beacon frame can only identify one SSID, mobile stations were required to actively probe for access points that supported a desired SSID. Furthermore, given the security issues presented by broadcasting SSID information, many network administrators typically disable broadcasts of SSID information for internal networks, but enabling it for guest access.
Enterprise users also desired to extend their virtual LAN (VLAN) configurations into the wireless domain. To allow enterprises to group wireless clients into different LANs, even though the wireless clients are associated with the same wireless access point, a given SSID was configured to map to a corresponding VLAN. Furthermore, a VLAN trunk link was configured between the wireless access point and a backbone switch. In a VLAN mode, the wireless access point ensures that broadcast/multicast packets transmitted to a group of wireless clients corresponding to one VLAN are not understood by other wireless clients. To achieve this, each VLAN is assigned a group encryption key. As a result, a wireless client with the correct key can decrypt a packet correctly, while other wireless clients outside that VLAN would encounter decryption errors when deciphering the packets.
Static assignment of VLANs to SSIDs can be problematic as it requires the configuration of every wireless client with an SSID that achieves the appropriate VLAN assignment. Accordingly, VLAN override methods were developed to allow users to be automatically grouped by a RADIUS server. Specifically, a RADIUS or other authentication server is configured to assign a VLAN to a wireless client after a successful EAP authentication. Depending on the VLAN identified by the RADIUS server, the wireless access point can then provide the appropriate group encryption key.
Wireless network administrators began to notice that the use of a single BSSID for all VLANs resulted in increased decryption errors and wasted battery power on the wireless clients. To address this problem, wireless access points were developed to support multiple BSSIDs (MBSSID). According to this methodology, each VLAN maps to a corresponding BSSID and group encryption key. The MBSSID solution addressed decryption errors, since a wireless client drops any packet that does not have the correct BSSID prior to decryption. This also conserves battery power as no computing resources are spent trying to decrypt wireless frames that are not transmitted from the BSSID to which the wireless client is associated.
The implementation of MBSSIDs, however, became problematic to the use of RADIUS servers for VLAN override. As discussed above, VLAN assignment occurs at the end of an EAP authentication. To authenticate to a RADIUS server, a wireless client must first associate with a BSSID; however, the BSSID to which the wireless client may first associate may not correspond to the VLAN to which the wireless client is ultimately assigned during EAP authentication. Indeed, if the assigned VLAN does not correspond to the current BSSID, the wireless client must associate to the BSSID that matches the VLAN assignment. IEEE 802.11 WLANs, however, do not support a mechanism that allows a wireless client to change a BSSID after EAP authentication.
One possible solution to this problem is to disable the VLAN override and configure the appropriate SSID on each wireless client, where the appropriate SSID is mapped to the appropriate BSSID, which is mapped to the assigned VLAN. This allows the grouping of wireless clients per VLAN, reduces broadcast traffic, and results in power savings for hand-held wireless clients. One disadvantage of this, however, is that the administrator must make sure to configure each wireless client with the correct SSID. Also, the administrator cannot change the VLAN configuration on the backbone without changing the wireless client configuration. Also, the NAC cannot be supported as the VLAN assignment changes dynamically.
A second possible solution is to duplicate broadcast packets to multiple BSSIDs. The disadvantage of this is that it increases decrypt errors at the wireless clients and also decreases the battery life of hand-held wireless clients, which defeats the purpose of MBSSID.
In light of the foregoing, a need in the art exists for methods, apparatuses, and systems that address the foregoing problems and facilitate integration of MBSSID modes of operation with VLAN override. Embodiments of the present invention substantially fulfill this need.